text:
With respect to the sale of information concerning the registration of any vehicle or the sale of information from the files of drivers’ licenses, the Department of Motor Vehicles shall, by regulation, establish administrative procedures under which any person making a request for information shall be required to identify himself or herself and state the reason for making the request. These procedures shall provide for the verification of the name and address of the person making a request for the information and the department may require the person to produce the information as it determines is necessary in order to ensure that the name and address of the person are his or her true name and address. These procedures may provide for a 10-day delay in the release of the requested information. These procedures shall also provide for notification to the person to whom the information primarily relates, as to what information was provided and to whom it was provided. The department shall, by regulation, establish a reasonable period of time for which a record of all the foregoing shall be maintained.

The procedures required by this subdivision do not apply to any governmental entity, any person who has applied for and has been issued a requester code by the department, or any court of competent jurisdiction.

history: (History: Amended by Stats. 1989, Ch. 1213, Sec. 2.)

title: 1.8. PERSONAL DATA

article: 7. Accounting of Disclosures


kind: section

code: CIV

text:
Each agency shall retain the accounting made pursuant to Section 1798.25 for at least three years after the disclosure for which the accounting is made, or until the record is destroyed, whichever is shorter.

Nothing in this section shall be construed to require retention of the original documents for a three-year period, providing that the agency can otherwise comply with the requirements of this section.

history: (History: Added by Stats. 1977, Ch. 709.)

title: 1.8. PERSONAL DATA

chapter: 1. Information Practices Act of 1977

article: 7. Accounting of Disclosures

path: 1.8. PERSONAL DATA > 1. Information Practices Act of 1977 > 7. Accounting of Disclosures


text: Each agency, after July 1, 1978, shall inform any person or agency to whom a record containing personal information has been disclosed during the preceding three years of any correction of an error or notation of dispute made pursuant to Sections 1798.35 and 1798.36 if (1) an accounting of the disclosure is required by Section 1798.25 or 1798.26, and the accounting has not been destroyed pursuant to Section 1798.27, or (2) the information provides the name of the person or agency to whom the disclosure was made, or (3) the person who is the subject of the disclosed record provides the name of the person or agency to whom the information was disclosed.

history: (History: Amended by Stats. 1985, Ch. 595, Sec. 13.)

title: 1.8. PERSONAL DATA

article: 7. Accounting of Disclosures


text:
(a) Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

(b) Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

(c) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.

(d) Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:

(1) The security breach notification shall be written in plain language, shall be titled “Notice of Data Breach,” and shall present the information described in paragraph (2) under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” Additional information may be provided as a supplement to the notice.

(A) The format of the notice shall be designed to call attention to the nature and significance of the information it contains.

(B) The title and headings in the notice shall be clearly and conspicuously displayed.

(C) The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.

(D) For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.[NAME OF INSTITUTION / LOGO] Date: [insert date]NOTICE OF DATA BREACH

What Happened?

What Information Was Involved?

What We Are Doing.

What You Can Do.

Other Important Information.[insert other important information]

For More Information.

Call [telephone number] or go to [internet website] (E) For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.

(2) The security breach notification described in paragraph (1) shall include, at a minimum, the following information:

(A) The name and contact information of the reporting agency subject to this section.

(B) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.

(C) If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.

(D) Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.

(E) A general description of the breach incident, if that information is possible to determine at the time the notice is provided.

(F) The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a driver’s license or California identification card number.

(3) At the discretion of the agency, the security breach notification may also include any of the following:

(A) Information about what the agency has done to protect individuals whose information has been breached.

(B) Advice on steps that people whose information has been breached may take to protect themselves.

(e) Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within Article 1 (commencing with Section 7923.600) of Chapter 1 of Part 5 of Division 10 of Title 1 of the Government Code.

(f) For purposes of this section, “breach of the security of the system” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.

(g) For purposes of this section, “personal information” means either of the following:

(1) An individual’s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(A) Social security number.

(B) Driver’s license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.

(C) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

(D) Medical information.

(E) Health insurance information.

(F) Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.

(G) Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.

(H) Genetic data.

(2) A username or email address, in combination with a password or security question and answer that would permit access to an online account.

(h) (1) For purposes of this section, “personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

(2) For purposes of this section, “medical information” means any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.

(3) For purposes of this section, “health insurance information” means an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records.

(4) For purposes of this section, “encrypted” means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.

(5) For purposes of this section, “genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

(i) For purposes of this section, “notice” may be provided by one of the following methods:

(1) Written notice.

(2) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.

(3) Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:

(A) Email notice when the agency has an email address for the subject persons.

(B) Conspicuous posting, for a minimum of 30 days, of the notice on the agency’s internet website, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agency’s internet website means providing a link to the notice on the home page or first significant page after entering the internet website that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.

(C) Notification to major statewide media and the Office of Information Security within the Department of Technology.

(4) In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change the person’s password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same username or email address and password or security question or answer.

(5) In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.

(j) Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.

(k) Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, “agency” includes a local agency, as defined in Section 7920.510 of the Government Code.

(l) For purposes of this section, “encryption key” and “security credential” mean the confidential key or process designed to render the data usable, readable, and decipherable.

(m) Notwithstanding any other law, the State Bar of California shall comply with this section. This subdivision shall not be construed to apply other provisions of this chapter to the State Bar.

history: (History: Amended by Stats. 2022, Ch. 419, Sec. 14. (AB 2958) Effective September 18, 2022.)

title: 1.8. PERSONAL DATA

article: 7. Accounting of Disclosures


text: Each agency shall either adopt regulations or publish guidelines specifying procedures to be followed in order fully to implement each of the rights of individuals set forth in this article.

history: (History: Amended by Stats. 1978, Ch. 874.)

title: 1.8. PERSONAL DATA

path: 1.8. PERSONAL DATA > 1. Information Practices Act of 1977 > 8. Access to Records and Administrative Remedies


text:
Each individual shall have the right to inquire and be notified as to whether the agency maintains a record about himself or herself. Agencies shall take reasonable steps to assist individuals in making their requests sufficiently specific.

Any notice sent to an individual which in any way indicates that the agency maintains any record concerning that individual shall include the title and business address of the agency official responsible for maintaining the records, the procedures to be followed to gain access to the records, and the procedures to be followed for an individual to contest the contents of these records unless the individual has received this notice from the agency during the past year.

In implementing the right conferred by this section, an agency may specify in its rules or regulations reasonable times, places, and requirements for identifying an individual who requests access to a record, and for disclosing the contents of a record.

history: (History: Amended by Stats. 1992, 1st Ex. Sess., Ch. 21, Sec. 33.6. Effective March 7, 1993.)

title: 1.8. PERSONAL DATA

article: 8. Access to Records and Administrative Remedies


text: Each agency may establish fees to be charged, if any, to an individual for making copies of a record. Such fees shall exclude the cost of any search for and review of the record, and shall not exceed ten cents ($0.10) per page, unless the agency fee for copying is established by statute.

title: 1.8. PERSONAL DATA


text:
(a) Except as otherwise provided in this chapter, each agency shall permit any individual upon request and proper identification to inspect all the personal information in any record containing personal information and maintained by reference to an identifying particular assigned to the individual within 30 days of the agency’s receipt of the request for active records, and within 60 days of the agency’s receipt of the request for records that are geographically dispersed or which are inactive and in central storage. Failure to respond within these time limits shall be deemed denial. In addition, the individual shall be permitted to inspect any personal information about himself or herself where it is maintained by reference to an identifying particular other than that of the individual, if the agency knows or should know that the information exists. The individual also shall be permitted to inspect the accounting made pursuant to Article 7 (commencing with Section 1798.25).

(b) The agency shall permit the individual, and, upon the individual’s request, another person of the individual’s own choosing to inspect all the personal information in the record and have an exact copy made of all or any portion thereof within 15 days of the inspection. It may require the individual to furnish a written statement authorizing disclosure of the individual’s record to another person of the individual’s choosing.

(c) The agency shall present the information in the record in a form reasonably comprehensible to the general public.

(d) Whenever an agency is unable to access a record by reference to name only, or when access by name only would impose an unreasonable administrative burden, it may require the individual to submit such other identifying information as will facilitate access to the record.

(e) When an individual is entitled under this chapter to gain access to the information in a record containing personal information, the information or a true copy thereof shall be made available to the individual at a location near the residence of the individual or by mail, whenever reasonable.

history: (History: Amended by Stats. 1985, Ch. 595, Sec. 15.)

title: 1.8. PERSONAL DATA


text:
Each agency shall permit an individual to request in writing an amendment of a record and, shall within 30 days of the date of receipt of such request:

(a) Make each correction in accordance with the individual’s request of any portion of a record which the individual believes is not accurate, relevant, timely, or complete and inform the individual of the corrections made in accordance with their request; or

(b) Inform the individual of its refusal to amend the record in accordance with such individual’s request, the reason for the refusal, the procedures established by the agency for the individual to request a review by the head of the agency or an official specifically designated by the head of the agency of the refusal to amend, and the name, title, and business address of the reviewing official.

title: 1.8. PERSONAL DATA


text: Each agency shall permit any individual who disagrees with the refusal of the agency to amend a record to request a review of such refusal by the head of the agency or an official specifically designated by the head of such agency, and, not later than 30 days from the date on which the individual requests such review, complete such review and make a final determination unless, for good cause shown, the head of the agency extends such review period by 30 days. If, after such review, the reviewing official refuses to amend the record in accordance with the request, the agency shall permit the individual to file with the agency a statement of reasonable length setting forth the reasons for the individual’s disagreement.

title: 1.8. PERSONAL DATA


text: The agency, with respect to any disclosure containing information about which the individual has filed a statement of disagreement, shall clearly note any portion of the record which is disputed and make available copies of such individual’s statement and copies of a concise statement of the reasons of the agency for not making the amendment to any person or agency to whom the disputed record has been or is disclosed.

title: 1.8. PERSONAL DATA


text: If information, including letters of recommendation, compiled for the purpose of determining suitability, eligibility, or qualifications for employment, advancement, renewal of appointment or promotion, status as adoptive parents, or for the receipt of state contracts, or for licensing purposes, was received with the promise or, prior to July 1, 1978, with the understanding that the identity of the source of the information would be held in confidence and the source is not in a supervisory position with respect to the individual to whom the record pertains, the agency shall fully inform the individual of all personal information about that individual without identification of the source. This may be done by providing a copy of the text of the material with only such deletions as are necessary to protect the identity of the source or by providing a comprehensive summary of the substance of the material. Whichever method is used, the agency shall insure that full disclosure is made to the subject of any personal information that could reasonably in any way reflect or convey anything detrimental, disparaging, or threatening to an individual’s reputation, rights, benefits, privileges, or qualifications, or be used by an agency to make a determination that would affect an individual’s rights, benefits, privileges, or qualifications. In institutions of higher education, “supervisory positions” shall not be deemed to include chairpersons of academic departments.

history: (History: Amended by Stats. 1985, Ch. 595, Sec. 16.)

title: 1.8. PERSONAL DATA


text: Sections 1798.35, 1798.36, and 1798.37 shall not apply to any record evidencing property rights.

title: 1.8. PERSONAL DATA


text:
This chapter shall not be construed to require an agency to disclose personal information to the individual to whom the information pertains, if the information meets any of the following criteria:

(a) Is compiled for the purpose of identifying individual criminal offenders and alleged offenders and consists only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status.

(b) Is compiled for the purpose of a criminal investigation of suspected criminal activities, including reports of informants and investigators, and associated with an identifiable individual.

(c) Is contained in any record which could identify an individual and which is compiled at any stage of the process of enforcement of the criminal laws, from the arrest or indictment stage through release from supervision and including the process of extradition or the exercise of executive clemency.

(d) Is maintained for the purpose of an investigation of an individual’s fitness for licensure or public employment, or of a grievance or complaint, or a suspected civil offense, so long as the information is withheld only so as not to compromise the investigation, or a related investigation. The identities of individuals who provided information for the investigation may be withheld pursuant to Section 1798.38.

(e) Would compromise the objectivity or fairness of a competitive examination for appointment or promotion in public service, or to determine fitness for licensure, or to determine scholastic aptitude.

(f) Pertains to the physical or psychological condition of the individual, if the agency determines that disclosure would be detrimental to the individual. The information shall, upon the individual’s written authorization, be disclosed to a licensed medical practitioner or psychologist designated by the individual.

(g) Relates to the settlement of claims for work related illnesses or injuries and is maintained exclusively by the State Compensation Insurance Fund.

(h) Is required by statute to be withheld from the individual to whom it pertains.

This section shall not be construed to deny an individual access to information relating to him or her if access is allowed by another statute or decisional law of this state.

history: (History: Added by Stats. 1985, Ch. 595, Sec. 18.)

title: 1.8. PERSONAL DATA


text:
(a) Except as provided in subdivision (c), if the agency determines that information requested pursuant to Section 1798.34 is exempt from access, it shall inform the individual in writing of the agency’s finding that disclosure is not required by law.

(b) Except as provided in subdivision (c), each agency shall conduct a review of its determination that particular information is exempt from access pursuant to Section 1798.40, within 30 days from the receipt of a request by an individual directly affected by the determination, and inform the individual in writing of the findings of the review. The review shall be conducted by the head of the agency or an official specifically designated by the head of the agency.

(c) If the agency believes that compliance with subdivision (a) would seriously interfere with attempts to apprehend persons who are wanted for committing a crime or attempts to prevent the commission of a crime or would endanger the life of an informant or other person submitting information contained in the record, it may petition the presiding judge of the superior court of the county in which the record is maintained to issue an ex parte order authorizing the agency to respond to the individual that no record is maintained. All proceedings before the court shall be in camera. If the presiding judge finds that there are reasonable grounds to believe that compliance with subdivision (a) will seriously interfere with attempts to apprehend persons who are wanted for committing a crime or attempts to prevent the commission of a crime or will endanger the life of an informant or other person submitting information contained in the record, the judge shall issue an order authorizing the agency to respond to the individual that no record is maintained by the agency. The order shall not be issued for longer than 30 days but can be renewed at 30-day intervals. If a request pursuant to this section is received after the expiration of the order, the agency must either respond pursuant to subdivision (a) or seek a new order pursuant to this subdivision.

history: (History: Added by renumbering Section 1798.40 by Stats. 1985, Ch. 595, Sec. 17.)

title: 1.8. PERSONAL DATA


text: In disclosing information contained in a record to an individual, an agency shall not disclose any personal information relating to another individual which may be contained in the record. To comply with this section, an agency shall, in disclosing information, delete from disclosure such information as may be necessary. This section shall not be construed to authorize withholding the identities of sources except as provided in Sections 1798.38 and 1798.40.

history: (History: Added by renumbering Section 1798.41 by Stats. 1985, Ch. 595, Sec. 19.)

title: 1.8. PERSONAL DATA


text: In disclosing information contained in a record to an individual, an agency need not disclose any information pertaining to that individual which is exempt under Section 1798.40. To comply with this section, an agency may, in disclosing personal information contained in a record, delete from the disclosure any exempt information.

history: (History: Added by renumbering Section 1798.42 by Stats. 1985, Ch. 595, Sec. 20.)

title: 1.8. PERSONAL DATA


text: This article applies to the rights of an individual to whom personal information pertains and not to the authority or right of any other person, agency, other state governmental entity, or governmental entity to obtain this information.

history: (History: Added by renumbering Section 1798.43 by Stats. 1985, Ch. 595, Sec. 21.)

title: 1.8. PERSONAL DATA


text:
An individual may bring a civil action against an agency whenever such agency does any of the following:

(a) Refuses to comply with an individual’s lawful request to inspect pursuant to subdivision (a) of Section 1798.34.

(b) Fails to maintain any record concerning any individual with such accuracy, relevancy, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, opportunities of, or benefits to the individual that may be made on the basis of such record, if, as a proximate result of such failure, a determination is made which is adverse to the individual.

(c) Fails to comply with any other provision of this chapter, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual.

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies

path: 1.8. PERSONAL DATA > 1. Information Practices Act of 1977 > 9. Civil Remedies


text:
In any suit brought under the provisions of subdivision (a) of Section 1798.45:

(a) The court may enjoin the agency from withholding the records and order the production to the complainant of any agency records improperly withheld from the complainant. In such a suit the court shall determine the matter de novo, and may examine the contents of any agency records in camera to determine whether the records or any portion thereof may be withheld as being exempt from the individual’s right of access and the burden is on the agency to sustain its action.

(b) The court shall assess against the agency reasonable attorney’s fees and other litigation costs reasonably incurred in any suit under this section in which the complainant has prevailed. A party may be considered to have prevailed even though he or she does not prevail on all issues or against all parties.

history: (History: Amended by Stats. 1985, Ch. 595, Sec. 22.)

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text:
Any agency that fails to comply with any provision of this chapter may be enjoined by any court of competent jurisdiction. The court may make any order or judgment as may be necessary to prevent the use or employment by an agency of any practices which violate this chapter.

Actions for injunction under this section may be prosecuted by the Attorney General, or any district attorney in this state, in the name of the people of the State of California whether upon his or her own complaint, or of a member of the general public, or by any individual acting in his or her own behalf.

history: (History: Amended by Stats. 1992, 1st Ex. Sess., Ch. 21, Sec. 33.7. Effective March 7, 1993.)

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text:
In any suit brought under the provisions of subdivision (b) or (c) of Section 1798.45, the agency shall be liable to the individual in an amount equal to the sum of:

(a) Actual damages sustained by the individual, including damages for mental suffering.

(b) The costs of the action together with reasonable attorney’s fees as determined by the court.

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text:
An action to enforce any liability created under Sections 1798.45 to 1798.48, inclusive, may be brought in any court of competent jurisdiction in the county in which the complainant resides, or has his principal place of business, or in which the defendant’s records are situated, within two years from the date on which the cause of action arises, except that where a defendant has materially and willfully misrepresented any information required under this section to be disclosed to an individual who is the subject of the information and the information so misrepresented is material to the establishment of the defendant’s liability to that individual under this section, the action may be brought at any time within two years after discovery by the complainant of the misrepresentation. Nothing in Sections 1798.45 to 1798.48, inclusive, shall be construed to authorize any civil action by reason of any injury sustained as the result of any information practice covered by this chapter prior to July 1, 1978.

The rights and remedies set forth in this chapter shall be deemed to be nonexclusive and are in addition to all those rights and remedies which are otherwise available under any other provision of law.

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text: A civil action shall not lie under this article based upon an allegation that an opinion which is subjective in nature, as distinguished from a factual assertion, about an individual’s qualifications, in connection with a personnel action concerning such an individual, was not accurate, relevant, timely, or complete.

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text: Where a remedy other than those provided in Articles 8 and 9 is provided by law but is not available because of lapse of time an individual may obtain a correction to a record under this chapter but such correction shall not operate to revise or restore a right or remedy not provided by this chapter that has been barred because of lapse of time.

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text:
Any person, other than an employee of the state or of a local government agency acting solely in his or her official capacity, who intentionally discloses information, not otherwise public, which they know or should reasonably know was obtained from personal information maintained by a state agency or from “records” within a “system of records” (as these terms are defined in the Federal Privacy Act of 1974 (P. L. 93-579; 5 U.S.C. 552a)) maintained by a federal government agency, shall be subject to a civil action, for invasion of privacy, by the individual to whom the information pertains.

In any successful action brought under this section, the complainant, in addition to any special or general damages awarded, shall be awarded a minimum of two thousand five hundred dollars ($2,500) in exemplary damages as well as attorney’s fees and other litigation costs reasonably incurred in the suit.

The right, remedy, and cause of action set forth in this section shall be nonexclusive and is in addition to all other rights, remedies, and causes of action for invasion of privacy, inherent in Section 1 of Article I of the California Constitution.

history: (History: Amended by Stats. 1985, Ch. 595, Sec. 23.)

title: 1.8. PERSONAL DATA

article: 9. Civil Remedies


text: The intentional violation of any provision of this chapter or of any rules or regulations adopted thereunder, by an officer or employee of any agency shall constitute a cause for discipline, including termination of employment.

title: 1.8. PERSONAL DATA

article: 10. Penalties

path: 1.8. PERSONAL DATA > 1. Information Practices Act of 1977 > 10. Penalties


text: Any person who willfully requests or obtains any record containing personal information from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than five thousand dollars ($5,000), or imprisoned not more than one year, or both.

history: (History: Amended by Stats. 1985, Ch. 595, Sec. 24.)

title: 1.8. PERSONAL DATA

article: 10. Penalties


text: Except for disclosures which are otherwise required or permitted by law, the intentional disclosure of medical, psychiatric, or psychological information in violation of the disclosure provisions of this chapter is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains.

history: (History: Added by Stats. 1986, Ch. 94, Sec. 1. Effective May 13, 1986.)

title: 1.8. PERSONAL DATA

article: 10. Penalties


text: An individual’s name and address may not be distributed for commercial purposes, sold, or rented by an agency unless such action is specifically authorized by law.

history: (History: Added by Stats. 1977, Ch. 709.)

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions

path: 1.8. PERSONAL DATA > 1. Information Practices Act of 1977 > 11. Miscellaneous Provisions


text:
(a) Nothing in this chapter shall prohibit the release of only names and addresses of persons possessing licenses to engage in professional occupations.

(b) Nothing in this chapter shall prohibit the release of only names and addresses of persons applying for licenses to engage in professional occupations for the sole purpose of providing those persons with informational materials relating to available professional educational materials or courses.

history: (History: Amended by Stats. 2000, Ch. 962, Sec. 1. Effective January 1, 2001.)

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text: Upon written request of any individual, any agency which maintains a mailing list shall remove the individual’s name and address from such list, except that such agency need not remove the individual’s name if such name is exclusively used by the agency to directly contact the individual.

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text: The provisions of this chapter shall be liberally construed so as to protect the rights of privacy arising under this chapter or under the Federal or State Constitution.

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text:
(a) Each agency record which is accepted by the Director of General Services for storage, processing, and servicing in accordance with provisions of the State Administrative Manual for the purposes of this chapter shall be considered to be maintained by the agency which deposited the record and shall continue to be subject to the provisions of this chapter. The Director of General Services shall not disclose the record except to the agency which maintains the record, or pursuant to rules established by such agency which are not inconsistent with the provisions of this chapter.

(b) Each agency record pertaining to an identifiable individual which was or is transferred to the State Archives as a record which has sufficient historical or other value to warrant its continued preservation by the California state government, prior to or after July 1, 1978, shall, for the purposes of this chapter, be considered to be maintained by the archives.

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text:
The time limits specified in Article 8 (commencing with Section 1798. 30) may be extended to 60 days by the Franchise Tax Board if the following conditions exist:

(a) The request is made during the period January 1 through June 30; and

(b) The records requested are stored on magnetic tape.

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text: Where an agency has recorded a document creating a lien or encumbrance on real property in favor of the state, nothing herein shall prohibit any such agency from disclosing information relating to the identity of the person against whom such lien or encumbrance has been recorded for the purpose of distinguishing such person from another person bearing the same or a similar name.

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text:
(a) Information which is permitted to be disclosed under the provisions of subdivision (e), (f), or (o), of Section 1798.24 shall be provided when requested by a district attorney.

A district attorney may petition a court of competent jurisdiction to require disclosure of information when an agency fails or refuses to provide the requested information within 10 working days of a request. The court may require the agency to permit inspection unless the public interest or good cause in withholding such records clearly outweighs the public interest in disclosure.

(b) Disclosure of information to a district attorney under the provisions of this chapter shall effect no change in the status of the records under any other provision of law.

history: (History: Added by Stats. 1979, Ch. 601.)

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text:
(a) Except as provided in subdivision (b), the State Board of Equalization may not release the names and addresses of individuals who are registered with, or are holding licenses or permits issued by, the State Board of Equalization except to the extent necessary to verify resale certificates or to administer the tax and fee provisions of the Revenue and Taxation Code.

(b) Nothing in this section shall prohibit the release by the State Board of Equalization to, or limit the use by, any federal or state agency, or local government, of any data collected by the board that is otherwise authorized by law.

history: (History: Added by Stats. 2000, Ch. 962, Sec. 2. Effective January 1, 2001.)

title: 1.8. PERSONAL DATA

article: 11. Miscellaneous Provisions


text: This chapter shall be construed to supersede any other provision of state law, including Article 2 (commencing with Section 7924.100) of Chapter 2 of Part 5 of Division 10 of Title 1 of the Government Code, or any exemption in Section 7922.000 of the Government Code or in any provision listed in Section 7920.505 of the Government Code, which authorizes any agency to withhold from an individual any record containing personal information that is otherwise accessible under the provisions of this chapter.

history: (History: Amended by Stats. 2021, Ch. 615, Sec. 46. (AB 474) Effective January 1, 2022. Operative January 1, 2023, pursuant to Sec. 463 of Stats. 2021, Ch. 615.)

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws

path: 1.8. PERSONAL DATA > 1. Information Practices Act of 1977 > 12. Construction With Other Laws


text: This chapter shall not be deemed to abridge or limit the rights of litigants, including parties to administrative proceedings, under the laws, or case law, of discovery of this state.

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text: Nothing in this chapter shall be construed to authorize the disclosure of any record containing personal information, other than to the subject of such records, in violation of any other law.

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text: Nothing in this chapter shall be construed to deny or limit any right of privacy arising under Section 1 of Article I of the California Constitution.

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text: The provisions of Chapter 13 (commencing with Section 67110) of Part 40 of the Education Code shall, with regard to student records, prevail over the provisions of this chapter.

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text: This chapter shall not be deemed to supersede Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code, except as to the provisions of Sections 1798.60, 1798.69, and 1798.70.

history: (History: Amended by Stats. 2021, Ch. 615, Sec. 47. (AB 474) Effective January 1, 2022. Operative January 1, 2023, pursuant to Sec. 463 of Stats. 2021, Ch. 615.)

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text: Nothing in this chapter shall be construed to revoke, modify, or alter in any manner any statutory provision or any judicial decision which (a) authorizes an individual to gain access to any law enforcement record, or (b) authorizes discovery in criminal or civil litigation.

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text:
Each agency shall ensure that no record containing personal information shall be modified, transferred, or destroyed to avoid compliance with any of the provisions of this chapter. In the event that an agency fails to comply with the provisions of this section, an individual may bring a civil action and seek the appropriate remedies and damages in accordance with the provisions of Article 9 (commencing with Section 1798.45).

An agency shall not remove or destroy personal information about an individual who has requested access to the information before allowing the individual access to the record containing the information.

history: (History: Added by Stats. 1985, Ch. 595, Sec. 26.)

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text: This chapter shall not be deemed to supersede the provisions of Chapter 1299 of the Statutes of 1976.

history: (History: Added by Stats. 1985, Ch. 595, Sec. 27.)

title: 1.8. PERSONAL DATA

article: 12. Construction With Other Laws


text:
(a) Except as provided in this section, a person or entity that intentionally remotely reads or attempts to remotely read a person’s identification document using radio frequency identification (RFID), for the purpose of reading that person’s identification document without that person’s knowledge and prior consent, shall be punished by imprisonment in a county jail for up to one year, a fine of not more than one thousand five hundred dollars ($1,500), or both that fine and imprisonment.

(b) A person or entity that knowingly discloses, or causes to be disclosed, the operational system keys used in a contactless identification document system shall be punished by imprisonment in a county jail for up to one year, a fine of not more than one thousand five hundred dollars ($1,500), or both that fine and imprisonment.

(c) Subdivision (a) shall not apply to:

(1) The reading of a person’s identification document for triage or medical care during a disaster and immediate hospitalization or immediate outpatient care directly related to a disaster, as defined by the local emergency medical services agency organized under Section 1797.200 of the Health and Safety Code.

(2) The reading of a person’s identification document by a health care professional for reasons relating to the health or safety of that person or an identification document issued to a patient by emergency services.

(3) The reading of an identification document of a person who is incarcerated in the state prison or a county jail, detained in a juvenile facility operated by the Division of Juvenile Facilities in the Department of Corrections and Rehabilitation, or housed in a mental health facility, pursuant to a court order after having been charged with a crime, or to a person pursuant to a court-ordered electronic monitoring.

(4) Law enforcement or government personnel who need to read a lost identification document when the owner is unavailable for notice, knowledge, or consent, or those parties specifically authorized by law enforcement or government personnel for the limited purpose of reading a lost identification document when the owner is unavailable for notice, knowledge, or consent.

(5) Law enforcement personnel who need to read a person’s identification document after an accident in which the person is unavailable for notice, knowledge, or consent.

(6) Law enforcement personnel who need to read a person’s identification document pursuant to a search warrant.

(d) Subdivision (a) shall not apply to a person or entity that unintentionally remotely reads a person’s identification document using RFID in the course of operating a contactless identification document system unless it knows it unintentionally read the document and thereafter intentionally does any of the following acts:

(1) Discloses what it read to a third party whose purpose is to read a person’s identification document, or any information derived therefrom, without that person’s knowledge and consent.

(2) Stores what it read for the purpose of reading a person’s identification document, or any information derived therefrom, without that person’s knowledge and prior consent.

(3) Uses what it read for the purpose of reading a person’s identification document, or any information derived therefrom, without that person’s knowledge and prior consent.

(e) Subdivisions (a) and (b) shall not apply to the reading, storage, use, or disclosure to a third party of a person’s identification document, or information derived therefrom, in the course of an act of good faith security research, experimentation, or scientific inquiry, including, but not limited to, activities useful in identifying and analyzing security flaws and vulnerabilities.

(f) Nothing in this section shall affect the existing rights of law enforcement to access data stored electronically on driver’s licenses.

(g) The penalties set forth in subdivisions (a) and (b) are independent of, and do not supersede, any other penalties provided by state law, and in the case of any conflict, the greater penalties shall apply.

history: (History: Amended by Stats. 2009, Ch. 54, Sec. 5. (SB 544) Effective January 1, 2010.)

title: 1.80. Identification Documents

path: 1.80. Identification Documents


text:
For purposes of this title:

(a) “Person or entity” means any individual, corporation, partnership, joint venture, or any business entity, or any state or local agency.

(b) “Personally identifying information” means:

(1) First and last name or last name only.

(2) Home or other physical address, including, but not limited to, a street name or ZIP Code, other than an address obtained pursuant to the California Safe At Home program or a business mailing address for the victim service provider.

(3) Electronic mail address or other online contact information, such as an instant messaging user identifier or a screen name that reveals an individual’s electronic mail address.

(4) Telephone number, other than a business telephone number for the victim service provider.

(5) Social security number.

(6) Date of birth, with the exception of the year of birth.

(7) Internet protocol address or host name that identifies an individual.

(8) Any other information, including, but not limited to, the first and last names of children and relatives, racial or ethnic background, or religious affiliation, that, in combination with any other nonpersonally identifying information, would serve to identify any individual.

(c) “Victim service provider” means a nongovernmental organization or entity that provides shelter, programs, or services at low cost, no cost, or on a sliding scale to victims of domestic violence, dating violence, sexual assault, or stalking, or their children, either directly or through other contractual arrangements, including rape crisis centers, domestic violence shelters, domestic violence transitional housing programs, and other programs with the primary mission to provide services to victims of domestic violence, dating violence, sexual assault, or stalking, or their children, whether or not that program exists in an agency that provides additional services.

history: (History: Added by Stats. 2006, Ch. 54, Sec. 1. Effective January 1, 2007.)

title: 1.807. DOMESTIC VIOLENCE, SEXUAL ASSAULT, AND STALKING: PERSONAL INFORMATION


text:
(a) In the course of awarding grants, including, but not limited to, requests for proposals, contracts, or billing procedures, implementing programs, or providing financial support or assistance for the purpose of providing shelter, programs, or services at low cost, no cost, or on a sliding scale to victims of domestic violence, dating violence, sexual assault, or stalking, or their children, to any victim service provider, it is unlawful for any person or entity to request or require that victim service provider to provide personally identifying information regarding any of the persons to whom it is providing services, it has provided services, or it has considered or is considering providing services.

(b) In the course of awarding grants, including, but not limited to, requests for proposals, contracts, or billing procedures, implementing programs, or providing financial support or assistance for the purpose of providing shelter, programs, or services at low cost, no cost, or on a sliding scale to victims of domestic violence, dating violence, sexual assault, or stalking, or their children, to any victim service provider, it is unlawful for any person or entity to request or require that victim service provider to use any computer software, computer program, computer protocol, or other computer system that requires the disclosure of personally identifying information regarding any of the persons to whom it is providing services, it has provided services, or it has considered or is considering providing services.

(c) Nothing in this section is intended to prevent the collection of information for statistical purposes that are necessary for the proper administration of the grant, program, or financial assistance, provided that collection does not require the disclosure of information that would serve to identify any specific individual.

path: 1.807. DOMESTIC VIOLENCE, SEXUAL ASSAULT, AND STALKING: PERSONAL INFORMATION


text: Injunctive relief shall be available to any victim service provider aggrieved by a violation of this title. The prevailing plaintiff in any action commenced under this section shall be entitled to recover court costs and reasonable attorney’s fees if the victim service provider has provided notice of this section and the asserted violation of this section to the defendant and the defendant has failed to cease the violation within five business days of receiving that notice.


text:
The following definitions apply to this title:

(a) “Business” means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, chartered, or holding a license or authorization certificate under the law of this state, any other state, the United States, or of any other country, or the parent or the subsidiary of a financial institution. The term includes an entity that disposes of records.

(b) “Records” means any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted, printed, or electromagnetically transmitted. “Records” does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number.

(c) “Customer” means an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.

(d) “Individual” means a natural person.

(e) “Personal information” means any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

history: (History: Amended by Stats. 2009, Ch. 134, Sec. 1. (AB 1094) Effective January 1, 2010.)

title: 1.81. CUSTOMER RECORDS

path: 1.81. CUSTOMER RECORDS


text: A business shall take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by (a) shredding, (b) erasing, or (c) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.

history: (History: Amended by Stats. 2009, Ch. 134, Sec. 2. (AB 1094) Effective January 1, 2010.)

title: 1.81. CUSTOMER RECORDS


text:
(a) (1) It is the intent of the Legislature to ensure that personal information about California residents is protected. To that end, the purpose of this section is to encourage businesses that own, license, or maintain personal information about Californians to provide reasonable security for that information.

(2) For the purpose of this section, the terms “own” and “license” include personal information that a business retains as part of the business’ internal customer account or for the purpose of using that information in transactions with the person to whom the information relates. The term “maintain” includes personal information that a business maintains but does not own or license.

(b) A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

(c) A business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party that is not subject to subdivision (b) shall require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

(d) For purposes of this section, the following terms have the following meanings:

(1) “Personal information” means either of the following:

(A) An individual’s first name or first initial and the individual’s last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:

(i) Social security number.

(ii) Driver’s license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.

(iii) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

(iv) Medical information.

(v) Health insurance information.

(vi) Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.

(vii) Genetic data.

(B) A username or email address in combination with a password or security question and answer that would permit access to an online account.

(2) “Medical information” means any individually identifiable information, in electronic or physical form, regarding the individual’s medical history or medical treatment or diagnosis by a health care professional.

(3) “Health insurance information” means an individual’s insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records.

(4) “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

(5) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

(e) The provisions of this section do not apply to any of the following:

(1) A provider of health care, health care service plan, or contractor regulated by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1).

(2) A financial institution as defined in Section 4052 of the Financial Code and subject to the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code).

(3) A covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Availability Act of 1996 (HIPAA).

(4) An entity that obtains information under an agreement pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code and is subject to the confidentiality requirements of the Vehicle Code.

(5) A business that is regulated by state or federal law providing greater protection to personal information than that provided by this section in regard to the subjects addressed by this section. Compliance with that state or federal law shall be deemed compliance with this section with regard to those subjects. This paragraph does not relieve a business from a duty to comply with any other requirements of other state and federal law regarding the protection and privacy of personal information.

history: (History: Amended by Stats. 2021, Ch. 527, Sec. 2. (AB 825) Effective January 1, 2022.)

title: 1.81. CUSTOMER RECORDS


text:
(a) A consumer credit reporting agency, as defined in 15 U.S.C. Sec. 1681a(p), that owns, licenses, or maintains personal information about a California resident, or a third party that maintains personal information about a California resident on behalf of a consumer credit reporting agency, that knows, or reasonably should know, that a computer system it owns, operates, or maintains, and for which it controls the security protocols, is subject to a security vulnerability that poses a significant risk, as defined in subdivision (c), to the security of computerized data that contains personal information, as defined in subdivision (h) of Section 1798.82, shall do all of the following:

(1) If a consumer credit reporting agency knows or reasonably should know that a software update is available to address the vulnerability as described in subdivision (a), the agency shall begin the necessary testing, planning, and assessment of its systems for implementation of that software update in the most expedient time possible and without unreasonable delay, in keeping with industry best practices, but in any case no later than three business days after becoming aware, or after the point at which it reasonably should have become aware, of the vulnerability and the available software update. The software update shall be completed in the most expedient time possible and without unreasonable delay, in keeping with industry best practices, but in any case no later than 90 days after becoming aware, or after the point at which it reasonably should have become aware, of the vulnerability and the available software update.

(2) Until the software update described in paragraph (1) is complete, the consumer credit reporting agency shall, in keeping with industry best practices, employ reasonable compensating controls to reduce the risk of a breach caused by computer system vulnerability as described in subdivision (a).

(b) Notwithstanding whether a software update is available, the consumer credit reporting agency, in keeping with industry best practices, shall do all of the following:

(1) Identify, prioritize, and address the highest risk security vulnerabilities most quickly in order to reduce the likelihood that the vulnerabilities that pose the greatest security risk will be exploited.

(2) Test and evaluate the impact of compensating controls and software updates and how they affect the vulnerability of the system to threats to the security of computerized data.

(3) Require, by contract, that the third party implement and maintain appropriate security measures for personal information. Contracting with a third party to maintain personal information about California residents shall not relieve the consumer credit agency of the requirements of this section.

(c) As used in this section, “significant risk” means a vulnerability score, calculated using a standard measurement system that is accepted as a best practice for the industry, to determine that the risk could reasonably result in a breach of the security of the system, as defined in subdivision (g) of Section 1798.82, of personal information, as defined in subdivision (h) of Section 1798.82.

(d) As used in this section, “compensating controls” means controls that the agency reasonably believes will prevent the computer system vulnerability as described in subdivision (a) from being exploited while the software update is being tested, assessed, and a plan for implementation is being developed, and have been adequately tested and confirmed to sufficiently offset the risk of breach caused by computer system vulnerability as described in subdivision (a).

(e) Nothing in this section shall reduce the responsibilities and obligations of a consumer credit reporting agency or third party under this title, including, but not limited to, Section 1798.81.5.

(f) The Attorney General has exclusive authority to enforce this section.

history: (History: Added by Stats. 2018, Ch. 532, Sec. 1. (AB 1859) Effective January 1, 2019.)

title: 1.81. CUSTOMER RECORDS


text:
(a) (1) An individual or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable.

(2) (A) Subject to subparagraph (B), the disclosure required by this subdivision shall be made within 30 calendar days of discovery or notification of the data breach.

(B) An individual or business may delay the disclosure required by this subdivision to accommodate the legitimate needs of law enforcement, pursuant to subdivision (c), or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

(b) An individual or business that maintains computerized data that includes personal information that the individual or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

(c) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.

(d) An individual or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:

(1) The security breach notification shall be written in plain language, shall be titled “Notice of Data Breach,” and shall present the information described in paragraph (2) under the following headings: “What Happened?” “What Information Was Involved?” “What We Are Doing,” “What You Can Do,” and “For More Information.” Additional information may be provided as a supplement to the notice.

(A) The format of the notice shall be designed to call attention to the nature and significance of the information it contains.

(B) The title and headings in the notice shall be clearly and conspicuously displayed.

(C) The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.

(D) For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.[NAME OF INSTITUTION / LOGO] Date: [insert date]NOTICE OF DATA BREACH

What Happened?

What Information Was Involved?

What We Are Doing.

What You Can Do.

Other Important Information.[insert other important information]

For More Information.

Call [telephone number] or go to [internet website] (E) For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.

(2) The security breach notification described in paragraph (1) shall include, at a minimum, the following information:

(A) The name and contact information of the reporting individual or business subject to this section.

(B) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.

(C) If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.

(D) Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.

(E) A general description of the breach incident, if that information is possible to determine at the time the notice is provided.

(F) The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a driver’s license or California identification card number.

(G) If the individual or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected individual for not less than 12 months along with all information necessary to take advantage of the offer to any individual whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).

(3) At the discretion of the individual or business, the security breach notification may also include any of the following:

(A) Information about what the individual or business has done to protect individuals whose information has been breached.

(B) Advice on steps that people whose information has been breached may take to protect themselves.

(C) In breaches involving biometric data, instructions on how to notify other entities that used the same type of biometric data as an authenticator to no longer rely on data for authentication purposes.

(e) A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.

(f) An individual or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers of the security breach. A single sample copy of a security breach notification shall not be deemed to be within Article 1 (commencing with Section 7923.600) of Chapter 1 of Part 5 of Division 10 of Title 1 of the Government Code.

(g) For purposes of this section, “breach of the security of the system” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the individual or business. Good faith acquisition of personal information by an employee or agent of the individual or business for the purposes of the individual or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.

(h) For purposes of this section, “personal information” means either of the following:

(1) An individual’s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(A) Social security number.

(B) Driver’s license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.

(C) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

(D) Medical information.

(E) Health insurance information.

(F) Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.

(G) Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.

(H) Genetic data.

(2) A username or email address, in combination with a password or security question and answer that would permit access to an online account.

(i) (1) For purposes of this section, “personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

(2) For purposes of this section, “medical information” means any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.

(3) For purposes of this section, “health insurance information” means an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records.

(4) For purposes of this section, “encrypted” means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.

(5) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

(j) For purposes of this section, “notice” may be provided by one of the following methods:

(1) Written notice.

(2) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.

(3) Substitute notice, if the individual or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the individual or business does not have sufficient contact information. Substitute notice shall consist of all of the following:

(A) Email notice when the individual or business has an email address for the subject persons.

(B) Conspicuous posting, for a minimum of 30 days, of the notice on the internet website page of the individual or business, if the individual or business maintains one. For purposes of this subparagraph, conspicuous posting on the individual’s or business’s internet website means providing a link to the notice on the home page or first significant page after entering the internet website that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.

(C) Notification to major statewide media.

(4) In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the individual or business may comply with this section by providing the security breach notification in electronic or other form that directs the individual whose personal information has been breached promptly to change the individual’s password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the individual or business and all other online accounts for which the individual whose personal information has been breached uses the same username or email address and password or security question or answer.

(5) In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the individual or business, the individual or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the individual or business knows the resident customarily accesses the account.

(k) For purposes of this section, “encryption key” and “security credential” mean the confidential key or process designed to render data usable, readable, and decipherable.

(l) Notwithstanding subdivision (j), an individual or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if the individual or business notifies subject individuals in accordance with its policies in the event of a breach of security of the system.

history: (History: Amended by Stats. 2025, Ch. 319, Sec. 1. (SB 446) Effective January 1, 2026.)

title: 1.81. CUSTOMER RECORDS